In common message inspection, only content under layer 4 of Internet Protocol (IP) packet are analyzed, including a source address, a target address, a source port, a target port, and a protocol type. In addition to the analysis of layer 4, Deep Packet Inspection (DPI) further includes an analysis of application layer, and identification of various applications and content of the various applications. By DPI technology, various applications in a network may be efficiently identified. At present, a DPI identification method existing in the industry includes pre-defining protocol characteristics, matching a data packet in the network with the characteristics, and identifying the matched data packet as a protocol matched. The predefined characteristic includes one or more characteristic conditions, and the characteristic conditions may be that the content of an application message matches some characters, meets a certain algorithm, meets a certain behavior pattern, or meets a combination of the above three conditions. In the same environment, decreasing match times may improve the protocol identification performance of the DPI, with the best performance being that once a data stream is input, match success is achieved after being matched with one characteristic.
In a conventional DPI match method, in order to decrease the match time, all characteristics in a characteristic library may be cascaded based on a certain specific order, and after a device runs, the match order of the characteristics is unchanged, so that the match performance becomes low.